From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
To: Eric Biggers <ebiggers@kernel.org>
Cc: "open list:HARDWARE RANDOM NUMBER GENERATOR CORE"
<linux-crypto@vger.kernel.org>,
linux-fscrypt@vger.kernel.org,
linux-arm-kernel <linux-arm-kernel@lists.infradead.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Herbert Xu <herbert@gondor.apana.org.au>,
Paul Crowley <paulcrowley@google.com>,
Greg Kaiser <gkaiser@google.com>,
"Jason A . Donenfeld" <Jason@zx2c4.com>,
Samuel Neves <samuel.c.p.neves@gmail.com>,
Tomer Ashur <tomer.ashur@esat.kuleuven.be>
Subject: Re: [RFC PATCH v3 10/15] crypto: poly1305 - use structures for key and accumulator
Date: Tue, 6 Nov 2018 15:28:24 +0100 [thread overview]
Message-ID: <CAKv+Gu-o0khD5=0EOkv2PiczMs5uZ=XP9V=G2ogBNMK8Kb93sw@mail.gmail.com> (raw)
In-Reply-To: <20181105232526.173947-11-ebiggers@kernel.org>
On 6 November 2018 at 00:25, Eric Biggers <ebiggers@kernel.org> wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> In preparation for exposing a low-level Poly1305 API which implements
> the ε-almost-∆-universal (εA∆U) hash function underlying the Poly1305
> MAC and supports block-aligned inputs only, create structures
> poly1305_key and poly1305_state which hold the limbs of the Poly1305
> "r" key and accumulator, respectively.
>
> Signed-off-by: Eric Biggers <ebiggers@google.com>
> ---
> arch/x86/crypto/poly1305_glue.c | 20 +++++++------
> crypto/poly1305_generic.c | 52 ++++++++++++++++-----------------
> include/crypto/poly1305.h | 12 ++++++--
> 3 files changed, 47 insertions(+), 37 deletions(-)
>
> diff --git a/arch/x86/crypto/poly1305_glue.c b/arch/x86/crypto/poly1305_glue.c
> index f012b7e28ad1..88cc01506c84 100644
> --- a/arch/x86/crypto/poly1305_glue.c
> +++ b/arch/x86/crypto/poly1305_glue.c
> @@ -83,35 +83,37 @@ static unsigned int poly1305_simd_blocks(struct poly1305_desc_ctx *dctx,
> if (poly1305_use_avx2 && srclen >= POLY1305_BLOCK_SIZE * 4) {
> if (unlikely(!sctx->wset)) {
> if (!sctx->uset) {
> - memcpy(sctx->u, dctx->r, sizeof(sctx->u));
> - poly1305_simd_mult(sctx->u, dctx->r);
> + memcpy(sctx->u, dctx->r.r, sizeof(sctx->u));
> + poly1305_simd_mult(sctx->u, dctx->r.r);
> sctx->uset = true;
> }
> memcpy(sctx->u + 5, sctx->u, sizeof(sctx->u));
> - poly1305_simd_mult(sctx->u + 5, dctx->r);
> + poly1305_simd_mult(sctx->u + 5, dctx->r.r);
> memcpy(sctx->u + 10, sctx->u + 5, sizeof(sctx->u));
> - poly1305_simd_mult(sctx->u + 10, dctx->r);
> + poly1305_simd_mult(sctx->u + 10, dctx->r.r);
> sctx->wset = true;
> }
> blocks = srclen / (POLY1305_BLOCK_SIZE * 4);
> - poly1305_4block_avx2(dctx->h, src, dctx->r, blocks, sctx->u);
> + poly1305_4block_avx2(dctx->h.h, src, dctx->r.r, blocks,
> + sctx->u);
> src += POLY1305_BLOCK_SIZE * 4 * blocks;
> srclen -= POLY1305_BLOCK_SIZE * 4 * blocks;
> }
> #endif
> if (likely(srclen >= POLY1305_BLOCK_SIZE * 2)) {
> if (unlikely(!sctx->uset)) {
> - memcpy(sctx->u, dctx->r, sizeof(sctx->u));
> - poly1305_simd_mult(sctx->u, dctx->r);
> + memcpy(sctx->u, dctx->r.r, sizeof(sctx->u));
> + poly1305_simd_mult(sctx->u, dctx->r.r);
> sctx->uset = true;
> }
> blocks = srclen / (POLY1305_BLOCK_SIZE * 2);
> - poly1305_2block_sse2(dctx->h, src, dctx->r, blocks, sctx->u);
> + poly1305_2block_sse2(dctx->h.h, src, dctx->r.r, blocks,
> + sctx->u);
> src += POLY1305_BLOCK_SIZE * 2 * blocks;
> srclen -= POLY1305_BLOCK_SIZE * 2 * blocks;
> }
> if (srclen >= POLY1305_BLOCK_SIZE) {
> - poly1305_block_sse2(dctx->h, src, dctx->r, 1);
> + poly1305_block_sse2(dctx->h.h, src, dctx->r.r, 1);
> srclen -= POLY1305_BLOCK_SIZE;
> }
> return srclen;
> diff --git a/crypto/poly1305_generic.c b/crypto/poly1305_generic.c
> index 47d3a6b83931..a23173f351b7 100644
> --- a/crypto/poly1305_generic.c
> +++ b/crypto/poly1305_generic.c
> @@ -38,7 +38,7 @@ int crypto_poly1305_init(struct shash_desc *desc)
> {
> struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
>
> - memset(dctx->h, 0, sizeof(dctx->h));
> + memset(dctx->h.h, 0, sizeof(dctx->h.h));
> dctx->buflen = 0;
> dctx->rset = false;
> dctx->sset = false;
> @@ -50,11 +50,11 @@ EXPORT_SYMBOL_GPL(crypto_poly1305_init);
> static void poly1305_setrkey(struct poly1305_desc_ctx *dctx, const u8 *key)
> {
> /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
> - dctx->r[0] = (get_unaligned_le32(key + 0) >> 0) & 0x3ffffff;
> - dctx->r[1] = (get_unaligned_le32(key + 3) >> 2) & 0x3ffff03;
> - dctx->r[2] = (get_unaligned_le32(key + 6) >> 4) & 0x3ffc0ff;
> - dctx->r[3] = (get_unaligned_le32(key + 9) >> 6) & 0x3f03fff;
> - dctx->r[4] = (get_unaligned_le32(key + 12) >> 8) & 0x00fffff;
> + dctx->r.r[0] = (get_unaligned_le32(key + 0) >> 0) & 0x3ffffff;
> + dctx->r.r[1] = (get_unaligned_le32(key + 3) >> 2) & 0x3ffff03;
> + dctx->r.r[2] = (get_unaligned_le32(key + 6) >> 4) & 0x3ffc0ff;
> + dctx->r.r[3] = (get_unaligned_le32(key + 9) >> 6) & 0x3f03fff;
> + dctx->r.r[4] = (get_unaligned_le32(key + 12) >> 8) & 0x00fffff;
> }
>
> static void poly1305_setskey(struct poly1305_desc_ctx *dctx, const u8 *key)
> @@ -107,22 +107,22 @@ static unsigned int poly1305_blocks(struct poly1305_desc_ctx *dctx,
> srclen = datalen;
> }
>
> - r0 = dctx->r[0];
> - r1 = dctx->r[1];
> - r2 = dctx->r[2];
> - r3 = dctx->r[3];
> - r4 = dctx->r[4];
> + r0 = dctx->r.r[0];
> + r1 = dctx->r.r[1];
> + r2 = dctx->r.r[2];
> + r3 = dctx->r.r[3];
> + r4 = dctx->r.r[4];
>
> s1 = r1 * 5;
> s2 = r2 * 5;
> s3 = r3 * 5;
> s4 = r4 * 5;
>
> - h0 = dctx->h[0];
> - h1 = dctx->h[1];
> - h2 = dctx->h[2];
> - h3 = dctx->h[3];
> - h4 = dctx->h[4];
> + h0 = dctx->h.h[0];
> + h1 = dctx->h.h[1];
> + h2 = dctx->h.h[2];
> + h3 = dctx->h.h[3];
> + h4 = dctx->h.h[4];
>
> while (likely(srclen >= POLY1305_BLOCK_SIZE)) {
>
> @@ -157,11 +157,11 @@ static unsigned int poly1305_blocks(struct poly1305_desc_ctx *dctx,
> srclen -= POLY1305_BLOCK_SIZE;
> }
>
> - dctx->h[0] = h0;
> - dctx->h[1] = h1;
> - dctx->h[2] = h2;
> - dctx->h[3] = h3;
> - dctx->h[4] = h4;
> + dctx->h.h[0] = h0;
> + dctx->h.h[1] = h1;
> + dctx->h.h[2] = h2;
> + dctx->h.h[3] = h3;
> + dctx->h.h[4] = h4;
>
> return srclen;
> }
> @@ -220,11 +220,11 @@ int crypto_poly1305_final(struct shash_desc *desc, u8 *dst)
> }
>
> /* fully carry h */
> - h0 = dctx->h[0];
> - h1 = dctx->h[1];
> - h2 = dctx->h[2];
> - h3 = dctx->h[3];
> - h4 = dctx->h[4];
> + h0 = dctx->h.h[0];
> + h1 = dctx->h.h[1];
> + h2 = dctx->h.h[2];
> + h3 = dctx->h.h[3];
> + h4 = dctx->h.h[4];
>
> h2 += (h1 >> 26); h1 = h1 & 0x3ffffff;
> h3 += (h2 >> 26); h2 = h2 & 0x3ffffff;
> diff --git a/include/crypto/poly1305.h b/include/crypto/poly1305.h
> index f718a19da82f..493244c46664 100644
> --- a/include/crypto/poly1305.h
> +++ b/include/crypto/poly1305.h
> @@ -13,13 +13,21 @@
> #define POLY1305_KEY_SIZE 32
> #define POLY1305_DIGEST_SIZE 16
>
> +struct poly1305_key {
> + u32 r[5]; /* key, base 2^26 */
> +};
> +
> +struct poly1305_state {
> + u32 h[5]; /* accumulator, base 2^26 */
> +};
> +
Sorry to bikeshed, but wouldn't it make more sense to have single definition
struct poly1305_val {
u32 v[5]; /* base 2^26 */
};
and have 'key' and 'accum[ulator]' fields of type struct poly1305_val
in the struct below?
> struct poly1305_desc_ctx {
> /* key */
> - u32 r[5];
> + struct poly1305_key r;
> /* finalize key */
> u32 s[4];
> /* accumulator */
> - u32 h[5];
> + struct poly1305_state h;
> /* partial buffer */
> u8 buf[POLY1305_BLOCK_SIZE];
> /* bytes used in partial buffer */
> --
> 2.19.1.930.g4563a0d9d0-goog
>
next prev parent reply other threads:[~2018-11-06 14:28 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-05 23:25 [RFC PATCH v3 00/15] crypto: Adiantum support Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 01/15] crypto: chacha20-generic - add HChaCha20 library function Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 02/15] crypto: chacha20-generic - don't unnecessarily use atomic walk Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 03/15] crypto: chacha20-generic - add XChaCha20 support Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 04/15] crypto: chacha20-generic - refactor to allow varying number of rounds Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 05/15] crypto: chacha - add XChaCha12 support Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 06/15] crypto: arm/chacha20 - limit the preemption-disabled section Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 07/15] crypto: arm/chacha20 - add XChaCha20 support Eric Biggers
2018-11-06 12:41 ` Ard Biesheuvel
2018-11-05 23:25 ` [RFC PATCH v3 08/15] crypto: arm/chacha20 - refactor to allow varying number of rounds Eric Biggers
2018-11-06 12:46 ` Ard Biesheuvel
2018-11-05 23:25 ` [RFC PATCH v3 09/15] crypto: arm/chacha - add XChaCha12 support Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 10/15] crypto: poly1305 - use structures for key and accumulator Eric Biggers
2018-11-06 14:28 ` Ard Biesheuvel [this message]
2018-11-12 18:58 ` Eric Biggers
2018-11-16 6:02 ` Herbert Xu
2018-11-17 0:17 ` Eric Biggers
2018-11-17 0:30 ` Ard Biesheuvel
2018-11-18 13:46 ` Jason A. Donenfeld
2018-11-19 5:24 ` [RFC PATCH] zinc chacha20 generic implementation using crypto API code Herbert Xu
2018-11-19 6:13 ` Jason A. Donenfeld
2018-11-19 6:22 ` Herbert Xu
2018-11-19 22:54 ` Eric Biggers
2018-11-19 23:15 ` Jason A. Donenfeld
2018-11-19 23:23 ` Eric Biggers
2018-11-19 23:31 ` Jason A. Donenfeld
2018-11-20 3:06 ` Herbert Xu
2018-11-20 3:08 ` Jason A. Donenfeld
2018-11-20 6:02 ` [RFC PATCH v2 0/4] Exporting existing crypto API code through zinc Herbert Xu
2018-11-20 6:04 ` [v2 PATCH 1/4] crypto: chacha20 - Export chacha20 functions without crypto API Herbert Xu
2018-11-20 6:04 ` [v2 PATCH 2/4] zinc: ChaCha20 generic C implementation and selftest Herbert Xu
2018-11-20 6:04 ` [v2 PATCH 3/4] zinc: Add x86 accelerated ChaCha20 Herbert Xu
2018-11-20 6:04 ` [v2 PATCH 4/4] zinc: ChaCha20 x86_64 implementation Herbert Xu
2018-11-20 10:32 ` [RFC PATCH v2 0/4] Exporting existing crypto API code through zinc Ard Biesheuvel
2018-11-20 14:18 ` Herbert Xu
2018-11-20 16:24 ` Jason A. Donenfeld
2018-11-20 18:51 ` Theodore Y. Ts'o
2018-11-21 7:55 ` Herbert Xu
2018-11-20 16:18 ` Jason A. Donenfeld
2018-11-21 6:01 ` Herbert Xu
2018-11-05 23:25 ` [RFC PATCH v3 11/15] crypto: poly1305 - add Poly1305 core API Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 12/15] crypto: nhpoly1305 - add NHPoly1305 support Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 13/15] crypto: arm/nhpoly1305 - add NEON-accelerated NHPoly1305 Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 14/15] crypto: adiantum - add Adiantum support Eric Biggers
2018-11-05 23:25 ` [RFC PATCH v3 15/15] fscrypt: " Eric Biggers
2018-11-08 6:47 ` [RFC PATCH v3 00/15] crypto: " Martin Willi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKv+Gu-o0khD5=0EOkv2PiczMs5uZ=XP9V=G2ogBNMK8Kb93sw@mail.gmail.com' \
--to=ard.biesheuvel@linaro.org \
--cc=Jason@zx2c4.com \
--cc=ebiggers@kernel.org \
--cc=gkaiser@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-fscrypt@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=paulcrowley@google.com \
--cc=samuel.c.p.neves@gmail.com \
--cc=tomer.ashur@esat.kuleuven.be \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).